AMENDMENTS TO THE CLAIMS 



This listing of claims will replace all prior versions, and listings, of claims 
in the application: 

Listing of Claims: 

1 1-66 (Canceled). 

1 67. (New) An authenticated-encryption method that uses an n-bit block 

2 cipher, a key, and an n-bit nonce to encrypt a message into a ciphertext, the 

3 method comprising: 

4 partitioning the message into m-1 message blocks and one final fragment, 

5 each message block having n bits and the final fragment having between 0 and n 

6 bits; 

7 using the block cipher, the key, and the nonce to generate a sequence of m 

8 offsets, each offset having n bits, wherein the sequence of offsets is computed by 

9 (a) computing a 0 th basis offset by applying the block cipher, keyed by the key, to 

10 a constant; (b) for each positive number i, defining the i th basis offset from the 

1 1 prior basis offset by shifting the prior basis offset left one position, and then 

12 xoring the resulting value with a constant that depends on the first bit of the prior 

13 basis offset; (d) computing a base offset by applying the block cipher, keyed by 

14 the key, to the xor of the 0 th basis offset and the nonce; (e) defining the 1 st offset 

1 5 in the sequence of offsets as the xor of the 0 th basis offset and the base offset; and 

16 (f) for each integer i between two and m, defining the i th offset in the sequence of 

17 offsets as the xor of the prior offset and the j th basis offset, where j is the number 

1 8 of zero-bits following the last one-bit when the number i is written in binary; 
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19 using the block cipher, the key, the nonce, and the length of the message to 

20 generate an n-bit final offset; 

21 for each number i between 1 and m-1, xoring the i th message block with 

22 the i th offset to determine an i th input block; 

23 for each number i between 1 and m-l 5 applying the block cipher, keyed by 

24 the key, to the i th input block, to determine an i th output block; 

25 for each number i between 1 and m-1, xoring the i th output block with the 

26 i* offset to determine an I th ciphertext block; 

27 concatenating the m-1 ciphertext blocks to determine a ciphertext body; 

28 computing an encoded length by encoding the length of the final fragment 

29 as an n-bit string; 

30 xoring the encoded length with the final offset to determine a precursor 

31 pad; 

32 computing a pad by applying the block cipher, keyed by the key, to the 

33 precursor pad; 

34 xoring the final fragment with a portion of the pad to determine a 

35 ciphertext fragment having the same length as the final fragment; 

36 computing a padded ciphertext fragment by appending to the ciphertext 

37 fragment a sufficient number of zero bits so that the padded ciphertext fragment 

38 has n bits; 

39 computing a checksum by xoring together the m-1 message blocks, the 

40 pad, and the padded ciphertext fragment; 

41 computing a precursor full tag by xoring together the checksum and the 

42 m th offset; 

43 determining a full tag by applying the block cipher, keyed by the key, to 

44 the precursor full tag; 

45 computing a tag as a portion of the full tag; and 
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46 defining the ciphertext to be the ciphertext body, the ciphertext fragment, 

47 and the tag. 

1 68. (New) A computer-readable storage medium storing instructions that 

2 when executed by a computer cause the computer to perform an authenticated- 

3 encryption method that uses an n-bit block cipher, a key, and an n-bit nonce to 

4 encrypt a message into a ciphertext, the method comprising: 

5 partitioning the message into m-1 message blocks and one final fragment, 

6 each message block having n bits and the final fragment having between 0 and n 

7 bits; 

8 using the block cipher, the key, and the nonce to generate a sequence of m 



9 offsets, each offset having n bits, wherein the sequence of offsets is computed by 

10 (a) computing a 0 th basis offset by applying the block cipher, keyed by the key, to 

1 1 a constant; (b) for each positive number i, defining the I th basis offset from the 

1 2 prior basis offset by shifting the prior basis offset left one position, and then 

1 3 xoring the resulting value with a constant that depends on the first bit of the prior 

14 basis offset; (d) computing a base offset by applying the block cipher, keyed by 

1 5 the key, to the xor of the 0 th basis offset and the nonce; (e) defining the 1 st offset 

16 in the sequence of offsets as the xor of the 0 th basis offset and the base offset; and 

17 (f) for each integer i between two and m, defining the i th offset in the sequence of 

1 8 offsets as the xor of the prior offset and the j 111 basis offset, where j is the number 

19 of zero-bits following the last one-bit when the number i is written in binary; 



20 using the block cipher, the key, the nonce, and the length of the message to 

21 generate an n-bit final offset; 

22 for each number i between 1 and m-1, xoring the i th message block with 

23 the i m offset to determine an i th input block; 

24 for each number i between 1 and m-1, applying the block cipher, keyed by 

25 the key, to the i th input block, to determine an i th output block; 
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26 for each number i between 1 and m- 1 , xoring the i* output block with the 

27 f 1 offset to determine an i th ciphertext block; 

28 concatenating the m-1 ciphertext blocks to determine a ciphertext body; 

29 computing an encoded length by encoding the length of the final fragment 

30 as an n-bit string; 

3 1 xoring the encoded length with the final offset to determine a precursor 

32 pad; 

33 computing a pad by applying the block cipher, keyed by the key, to the 

34 precursor pad; 

35 xoring the final fragment with a portion of the pad to determine a 

36 ciphertext fragment having the same length as the final fragment; 

37 computing a padded ciphertext fragment by appending to the ciphertext 

38 fragment a sufficient number of zero bits so that the padded ciphertext fragment 

39 has n bits; 

40 computing a checksum by xoring together the m-1 message blocks, the 

41 pad, and the padded ciphertext fragment; 

42 computing a precursor full tag by xoring together the checksum and the 

43 m th offset; 

44 determining a full tag by applying the block cipher, keyed by the key, to 

45 the precursor full tag; 

46 computing a tag as a portion of the full tag; and 

47 defining the ciphertext to be the ciphertext body, the ciphertext fragment, 

48 and the tag. 

1 69. (New) An authenticated-encryption method that uses an n-bit block 

2 cipher, a key, and an n-bit nonce to encrypt a message into a ciphertext, the 

3 method comprising: 

4 partitioning the message into m-1 message blocks and one final fragment, 
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5 each message block having n bits and the final fragment having between 0 and n 

6 bits; 

7 generating m+1 offsets using a sequence shift and xor operations, this 

8 sequence of shift and xor operations being applied to a starting value determined 

9 using the block cipher, the key, and the nonce; 

10 for each number i between 1 and m-1, xoring the i th message block with 

1 1 the I th offset to determine an i th input block; 

12 for each number i between 1 and m-1, applying the block cipher, keyed by 

13 the key, to the i th input block, to determine an i* output block; 

14 for each number i between 1 and m-1, xoring the i th output block with the 

15 i th offset to determine an ciphertext block; 

16 concatenating the m-1 ciphertext blocks to determine a ciphertext body; 

17 computing an encoded length by encoding the length of the final fragment 

18 as an n-bit string; 

19 xoring the encoded length with the m th offset to determine a precursor pad; 

20 computing a pad by applying the block cipher, keyed by the key, to the 

21 precursor pad; 

22 xoring the final fragment with a portion of the pad to determine a 

23 ciphertext fragment having the same length as the final fragment; 

24 computing a padded ciphertext fragment by appending to the ciphertext 

25 fragment a sufficient number of zero bits so that the padded ciphertext fragment 

26 has n bits; 

27 computing a checksum by xoring together the m-1 message blocks, the 

28 pad, and the padded ciphertext fragment; 

29 computing a precursor full tag by xoring together the checksum and the 

30 (m+l) st offset; 

3 1 determining a full tag by applying the block cipher, keyed by the key, to 

32 the precursor full tag; 
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33 computing a tag as a portion of the full tag; and 

34 defining the ciphertext to be the ciphertext body, the ciphertext fragment, 

35 and the tag. 

1 70 (New) A computer-readable storage medium storing instructions that 

2 when executed by a computer cause the computer to perform an authenticated- 

3 encryption method that uses an n-bit block cipher, a key, and an n-bit nonce to 

4 encrypt a message into a ciphertext, the method comprising: 

5 partitioning the message into m-1 message blocks and one final fragment, 

6 each message block having n bits and the final fragment having between 0 and n 

7 bits; 

8 generating m+1 offsets using a sequence shift and xor operations, this 

9 sequence of shift and xor operations being applied to a starting value determined 

10 using the block cipher, the key, and the nonce; 

1 1 for each number i between 1 and m-1, xoring the i th message block with 

12 the i th offset to determine an i th input block; 

13 for each number i between 1 and m-1, applying the block cipher, keyed by 

14 the key, to the input block, to determine an i th output block; 

15 for each number i between 1 and m-1, xoring the I th output block with the 

16 I th offset to determine an i th ciphertext block; 

1 7 concatenating the m-1 ciphertext blocks to determine a ciphertext body; 

1 8 computing an encoded length by encoding the length of the final fragment 

19 as an n-bit string; 

20 xoring the encoded length with the m th offset to determine a precursor pad; 

21 computing a pad by applying the block cipher, keyed by the key, to the 

22 precursor pad; 

23 xoring the final fragment with a portion of the pad to determine a 

24 ciphertext fragment having the same length as the final fragment; 
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25 computing a padded ciphertext fragment by appending to the ciphertext 

26 fragment a sufficient number of zero bits so that the padded ciphertext fragment 

27 has n bits; 

28 computing a checksum by xoring together the m-1 message blocks, the 

29 pad, and the padded ciphertext fragment; 

30 computing a precursor full tag by xoring together the checksum and the 

31 (m+l) st offset; 

32 determining a full tag by applying the block cipher, keyed by the key, to 

33 the precursor full tag; 

34 computing a tag as a portion of the full tag; and 

35 defining the ciphertext to be the ciphertext body, the ciphertext fragment, 

36 and the tag. 
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